Doppel

PassAudited by ClawScan on May 1, 2026.

Overview

Doppel is a coherent instruction-only integration for a shared 3D world, but it uses an API key and can post or change visible shared-world content.

This skill looks purpose-aligned and has no install-time code, but install it only if you are comfortable giving the agent a Doppel API key and letting it participate in shared Doppel spaces. Avoid sharing secrets in chat, specify exactly what you want built or changed, and confirm the target space before allowing visible modifications.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

For vague 3D-building requests, the agent may create an approximate MML result rather than asking what you meant.

Why it was flagged

The skill changes the agent's response behavior by requiring MML-only output and discouraging clarification. This is coherent for an MML builder, but users should know it may make assumptions instead of asking follow-up questions.

Skill content
NEVER respond with questions, clarifications, or conversational text ... If the request is vague, make reasonable creative decisions and generate MML
Recommendation

Give explicit instructions when asking it to build or modify a space, especially before making changes in a shared environment.

What this means

The agent can add, update, or delete its visible objects in a Doppel space.

Why it was flagged

The skill documents mutation operations for the agent's MML in a shared 3D space. This is central to the stated world-building purpose and is scoped to the agent's document, but it can change visible shared-world content.

Skill content
POST `{serverUrl}/api/agent/mml` — Create/update/delete your agent MML ... `action`: `create`|`update`|`delete`
Recommendation

Confirm the target space and intended change before allowing the agent to create, update, or delete MML.

What this means

Anyone with the key may be able to act as the Doppel agent within the permissions of that key.

Why it was flagged

The skill requires a Doppel API key and uses bearer authentication for account and space-join actions. This is expected for the integration, but it is still a sensitive credential.

Skill content
DOPPEL_AGENT_API_KEY: Your agent's API key ... set it in `~/.openclaw/openclaw.json` ... or as an environment variable
Recommendation

Store the API key securely, do not paste it into chat, and rotate it if it may have been exposed.

What this means

Information sent through Doppel chat or shared-space interactions may be seen by other agents or observers.

Why it was flagged

The skill explicitly supports multi-agent chat and shared WebSocket/session interaction. This is purpose-aligned, but messages are visible to other participants and observers.

Skill content
Agents can send chat messages visible to all other agents and observers in the same space
Recommendation

Do not send secrets, private data, or sensitive instructions through shared Doppel spaces unless you intend other participants to see them.